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Check APN 


Make sure to use the correct APN. The default APN used 
for Telenor loT services is “telenor.iot”. 


Read application note 


The Application Note should provide you with all the 
information you need to apply Telenor loT sim cards. 


Call us for loT support 


If you need further technical assistance, please contact 
our customer support on +45 72 12 86 17. 
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1. Introduction 


1.1. Purpose 


The purpose of this document is to describe the technical properties of the Telenor loT 
connectivity product and offer guidance on how to use and integrate the connectivity service 
into the customers end-product. 


1.2. Scope 


The document describes the key parameters of the product, and how these should be 
handled by the customer. Basic modem procedures, allowing the customer device to attach 
and register with the Telenor network will be described for a selected number of chipsets. 


The document is focused on the network and communication related aspects of using the 
loT product. Issues associated with actual application and functionality ofthe customer 
devices are not addressed. 


2. Product Description (One-loT) 


2.1. Radio technologies 


The One-loT product is offered on the following radio access technologies: 


) X ko) Qh 
a (Y “la me | Ce 
Mobility Data rates Latency Indoor Battery life Additional 

penetrations services 


fan SMS support 
3G 


Full 300/100 kbps High (<2s) Maximum Short Sh FEL 
Voice support 


£ ¡ah (< SMS support 

4G/LTE-M 1/1 Mbps High (<1s) Very good Very long 

Ea joic Suppor 
Voice support 


(*) Theoretical Max Speed > 1 Gbps 


2.2. Frequency Bands 


With a few exceptions, the current Telenor implementation for NB-loT and LTE-M is on Band 
20 (L800). Other bands are L900, L1800, L2100 and L2600 for 4G, and 900 and 1800 layers for 
2G coverage. Telenor Denmark’s Coverage Map for loT is available via this link: 
https://www.telenor.dk/erhverv/kundeservice/drift-og-dakning/dakning/dakningskort/ 
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2.3. APN 


The default APN used for Telenor loT services is telenor.iot. This APN will direct traffic 
towards the open internet. The APN is pushed by the network and will be used if leaving the 
APN field empty in the AT command, but can also be manually selected (see further details in 
commands section). It is important to make sure that the device is not attempting to use an 
unsupported APN such as internet, which is the default APN in many other connectivity 
products. 


For connecting the device to a customer specific network with a dedicated APN name, please 
contact Telenor at iot@telenor.dk for further information. 


2.4, Features 


The main NB-loT and LTE-M features (3GPP Rel. 13 and 3GPP Rel. 14) are already 
implemented or are to be implemented within the coming months. Below is a list of the main 
features: 


Power Savings Mode (PSM) NB-loT and LTE-M (Rel. 13) Implemented 
eDRX NB-loT and LTE-M (Rel. 13) 2022 
Multiple Coverage Levels NB-loT (Rel. 13) Implemented 
Multiple Coverage Levels LTE-M (Rel. 13) 2021 
Intra-frequency Idle Mode Mobility NB-loT (Rel. 13) Implemented 
Connected Mode Mobility Support LTE-M (Rel. 13) plemented 
(Intra-Freq Only) 
VoLTE Support LTE-M (Rel. 13) Implemented 
Ea, ID-based Location NB-loT (Rel. 14) 2022 
Sea ID-based Location LTE-M Rel. 14) 2022 
il Eee NB-loT (Rel. 13) Not supported 
ee ee ees LTE-M (Rel. 13) Not supported 
SMS on NB-loT NB-loT (Rel. 13) Not supported 
2.5. Roaming 


NB-loT and LTE-M roaming is fairly new to many operators - hence currently with limited 
roll-out, but new agreements are continuously introduced. Please contact Telenor at 
iot@telenor.dk for latest information on NB-loT and LTE-M roaming. 
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As for the already available extensive roaming setup for 2G and 4G-LTE, please see our 


roaming map for complete overview: 


https://www.telenor.dk/erhverv/shop/mobilabonnementer/roaming-usp/ 


2.6. IP Address Ranges 


The assigned IP addresses are. IPv4. Telenor is utilizing CGNAT, where every device will be 
assigned an internal IP, and sharing public IP with other devices. 


For managing the IP addresses, and for Radius support, please contact Telenor at 
iot@telenor.dk for further information. 


2.7. Data overhead 


All information transferred across the network is subject to measurement and will be rated 
according to the actual data plan. This includes IP and UDP header information, TCP, FTP 
and other protocol overhead, as well as the ordinary payload data. 


Example: 100-byte payload data transferred in a single UDP packet, means a total of 128 
bytes are assessed due to the IP+UDP header overhead. 


Control planetraffic used for network attach, detach, etc. is not rated. 


3. Basic Modem procedures 


The procedures necessary to attach the modem to the Telenor network will be described in 
terms of the necessary AT commands and associated responses. Many chipset vendors offer 
proprietary commands in addition to the ETSI’command set. This document will offer some 
support to selected vendors, but it is highly recommended to seek this information from the 
different vendor support pages. 


The following colour legend is applied in the following command tables: 


uBlox Quectel Simcom ‘Telit ETSI 
| 


3.1. SIM PIN code 


The loT SIM cards delivered from Telenor contains two PINs: 


e  PIN1=1234 
+  PIN2=0000 (NO PIN) 


Status of the PIN can be: 


1 https://www.etsi.org/deliver/etsi ts/127000 127099/127007/16.05.00 60/ts 127007v160500p.pdf 
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e Disabled means that PIN value is not needed. All files that have access set to PIN1 are open. 


e Random means that value is being calculated randomly during data processing so each card 
during personalization gets its own unique random value. Those values can then be checked 
in output file. 

e Blocked means that PIN2 value is not available and to give its value first it is needed to 
unblock it by giving correct value of PUK2. When providing value of PUK2 in APDU command 
new value for PIN2 is required so end user can set his own new value for PIN2. 


Default value for the Telenor loT SIM cards are Disabled. 


If a PIN is assigned, it is not possible to access the SIM and Attach to the Network before the 
PIN has been applied. 


>+CPIN: Check if a PIN is required: If the response 
READY >OK_ is'READY' there is NO PIN required: 


Check PIN AT+CPIN? 
es : E If a PIN is required, it will response with 
OK "SIM PIN': 
Provide the PIN AT+CPIN="1234" > OK Provide the PIN to allow access to the 
SIM: 
After providing the 'PIN' It is possible to 
AT Che KO NS C7730 
Remove the PIN 00007,1 e > OK remove the 'PIN', for easy access in the 
í future, by AT Command. 
> <IMSI 
number> 
fe Obtain IMSI and IMEI information from 
Request IMEI / IMSI AT+CIMI;+CGSN=1; > +CGSN: A 3 nerna enie 
<IMEI SIM and device. 
number> 
EOK 


3.2. Attach 


This is the essential first step to start with the loT device, therefore being mandatory. The 
steps to be followed are: 


1. Make sure thatthe SIM card is inserted correctly into the device and ready to work (i.e. SIM 
PIN procedure completed). Force the device towards the correct frequency band(s). 

2. Force the device towards the correct operator and technology. It's also possible to run this 
step in Auto-Mode, and let the device choose operator and technology. However, in some 
cases this can lead to an incorrect choice, depending on the default behaviour ofthe device. 

3. Force the device to attach. 
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Enable to use CEREG to show 


AT+CEREG=2 > OK 
Shon NW Deta Registration Status, TAC, Cell ID, RAT 
0: LTE Cat M1. The second number 
AT+UBANDMASK=0, 52 indicates the bandmask for LTE bands 1 
4290 > OK to 64. 
AT+UBANDMASK=1, 52 1: LTE Cat NB1. The second number 
4290 indicates the bandmask for LTE bands 1 
to 64. 
AT+QCFG=“band”|[,<gsmbandval>,<ca 
AT+OCFG="band”,.. > OK tm1bandval>,<catnb1bandval>[,<effec 


t>]] 


Band Selection 


AT#IOTBND=[<lte_m1_band_pref.bits_1_ 
64>][,[<lte_m1_band_pref.bits_65_128>] 

[,<lte_nb1_band_pref.bits_1_64>[,<lte_n 

b1_band_pref.bits_65_128>]]] 


AT#IOTBND-=..., ...,... > OK 


The last number in the AT Command 


AT+COPS=1,2,"2380 : : 

on G / > OK Sequence is the radio access technology 
Operator and / or RAT ý to be accessed, M1 = 8 and NB =9. 
Selection 

AT+URAT=X > OK RAT Selection only uBlox, M1 =7, NB=8 
ON UA > OK Sets the MT to full fu nctionality, e.g. from 

airplane mode or minimum functionality 
+CEREG: 

nata ea? 2,1,"36DB Check Registration Status, TAC, Cell ID, 


","2A4572 RAT 
Qu. 8 


3.3. PDP context 


The Packet Data Protocol (PDP) Context is needed to allow the device to transmit data (IP 
Packets). 


It is necessary to make sure that the APN is correct. This must be done either by manually 
selecting and pushing the APN, or by letting the network push the default APN. 


Telenor uses the default APN “telenor.iot” for loT services. 
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Defines the connection parameters for 
AT+CGDCONT=1,"IP" creating and setup a PDP context for IP 
,"telenor.iot" Data Transmission. Initially as specified 
by ETSI, The Access Point Name, can be, 
a string parameter, a logical name to 


AT+OCGDEFCONT="1P selectthe GGSN or the external packet 


Define PDP Context " "telenor.iot" > OK data network. 
If the value is 'null' or omitted by "", then 
the subscription value will be requested 
from the Network. 
AT*MCGDEFCONT="IP The Proprietary Quectel BC66 and 
u Unecubevanere , Tors Simcom SIM7020 Commands stores 
| the definition as 'Default' in the modem. 
+CGDCONT: 
Pa ES Verify that the PDP context is created and 
Verify PDP Context AT+CGDCONT? mm : oe have been assigned an 'IP' Address 
z Š " " 
“xX xxx",  "XXXX.XX.XXX 
OOOO 
3.4. Detach 


This step is highly recommended before switching off the device to make sure that the 
network is aware of the device status. 


Sets the MT to minimum functionality 
(disable both transmit and receive RF 
circuits by deactivating both CS and PS 
services). 

Force Detach AT+CFUN=0 > OK It can be up to the manufacturer whether 
this command will affect the network 
registration. In negative case, use 
AT+COPS=2 in order to force the 
deregistration. 


+CEREG: Check Registration Status. 
2,1,<TAC> Having CEREG previously set to 2 will 
Check NW Status AT+CEREG? , <Cell show TAC, Cell ID, and RAT, with RAT that 
ee B in case of deregistration will be equal to 
‘B’. 


3.5. PSM 


The Power Saving Mode Feature is based on 2 timers: 


e 13412, Tracking Area Update Timer: It represents the PSM cycle duration, i.e. when it 
expires, the network is notified of the availability of the terminal. 

e 13324, Active Timer: Duration during which the terminal is reachable for mobile- 
terminated data. It starts after transition from Connected to Idle, and when it expires 
the terminal enters the Power Saving Mode. 
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+CPSMS: 0; 
zo “ODO 
00",'0000 
LOLON 0X 


Check PSM Status 


Enable PSM 


Check PSM Status 


AT+CPSMS? 


AT+CPSMS=1,,,"000 
00000","00000000" 


AT+CPSMS? 


AT+CPSMS= 
Trop IQ 
0011","00 
100001" > 
OK 


+CPSMS: i, 
OOOO 
Oe OOO 
LALO Or 


Verify that PSM is not enabled, '0' 
Indicate that PSM is not active 


Enable PSM, first Timer is T3412 (Total), 
second Timer is T3324 (Active) 


Verify that PSM is enabled and that the 
Timers are correct, '1' Indicate that PSM 
is active 


Disable PSM. Defined Timers are kept if 


AT+CPSMS=0 > OK ot 
re-enabling it 


Disable PSM 


eos Or 
,,"000110 Verify that PSM is now disabled, '0' 


00","0000 Indicate that PSM is not active 
LOLON GX 


Check PSM Status AT+CPSMS? 


3.5.1. PSM Timers 


T3412 (Total); first 3 Bits are the Multiplication Factor: T3324 (Active); first 3 Bits are the Multiplication Factor: 


000 10 Minutes 000 2 Seconds 
001 1 Hour 001 1 Minute 
010 10 Hours 010 6 Minutes 
011 2 Seconds 011 - 

100 30 Seconds 100 - 

101 1 Minute 101 = 

110 320 Hours 110 = 

111 Deactivate 111 Deactivate 


4, Proprietary commands explained 


4.1. Quectel BG96 


Quectel BG96 AT Commands 
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AT+QCFG="band" - Band Configuration 


Write Command 
AT+QCFG=“band”[,<gsmbandval>,<ca 
tm1bandval>,<catnbibandval>[,<effect>]] 


Read Command AT+QCFG=“band” 
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Response 
If configuration parameters are all entered, configure the 
frequency bands allowed to be searched: OK 


If there is an error related to ME functionality, response: +CME 
ERROR: <err> 


If there is any other error, response: ERROR 


Other possible Parameters: 

<nwscanmode> Number format. RAT(s) to be searched. 
O Automatic, 1 GSM only, 3 LTE only 

<effect> Number format. When to take effect. 

O Take effect after UE reboots, 1 Take effect immediately 


Response Return 
the current configuration: +QCFG:“band”, 


<gsmbandval>,<catm1bandval>, <catnb 1bandval> OK 


AT+CBANDSL Set Modem NB-IOT Search Prefer Band List 


Test Command T+CBANDSL= ? 


Write Command 
AT+CBANDSL= 
<enable>[,<band 
number>,<band 
1>[,<band2>[,<b 
and3>[,<band4>]] 
1 
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Response 

+CBANDSL: (list of supported <enable>s), (list of supported <band 
number>s) ,(list of supported <band>s) 

oK 


Parameter 
See Write Command 


Response 

OK 

If error is related to ME functionality: 
+CME ERROR: <err> 


Parameter 


<enable> Integer value indicating search prefer band list enable or 


disable 

0 Disable 

1 Enable 

<band number> Integer value indicating search prefer band 
number. 

Valid values: 1,2,3,4 

<bandn> Integer value indicating current search prefer NB-IOT 
band. 

Valid values: 1,2,3,5,8,11,12,13,17,18,19,20,21,25,26,28,31,66,70 


Sensitivity: Internal 


Read Command 
AT+CBANDSL? 


Parameter Saving 
Mode 


4.3. Telit ME910 
Telit ME910 


CAT-M1 & NB-loT Band Setting - AT#IOTBND 


Write Command 
AT#IOTBND=[<lte_m1_band_pref.bits_1_64>]|[ 
,[<lte_m1_band_pref.bits_65_128>] 
[,<lte_nb1_band_pref.bits_1_64>[,<lte_nb1_b 
and_pref.bits_65_128>]]] 


Read Command AT#IOTBND? 


Test Command AT#IOTBND=? 
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Response 
+CBANDSL: <band> 
OK 


Parameters 
See Write Command 


AUTO_SAVE 


Response #lIOTBND: 
<lte_m1_band_pref.bits_1_64>,<lte_m1_band_pref.bits_65_128> 
,<lte_nb1_band_pref.bits_1_64> 
,<lte_nb1_band_pref.bits_65_128> 


Parameter 

<lte_m1_band_pref.bits_1_64> integer - indicates the lower (1-64) 
CAT-M1 supported bands, expressed as the sum of Band number 
(1+2+8 ...); see #BND command <lte_m1_band_pref.bits_65_128> 
integer - indicates the higher (65-128) CATM1 supported bands, 
expressed as the sum of Band number (0 meaning "no high band 
selected"); see #BND command <lte_nb1_band_pref.bits_1_64> 
integer - indicates the lower (1-64) NB-loT supported bands, 
expressed as the sum of Band number (1+2+8 ...); see #BND 
command <lte_nb1_band_pref.bits_65_128> integer - indicates 
the higher (65-128) NB-loT supported bands, expressed as the 
sum of Band number (0 meaning "no high band selected"); see 
#BND command 


Read command returns the current parameters setting for 
#IOTBND command in the format: 


#IOTBND: 
<lte_m1_band_pref.bits_1_64>,<lte_m1_band_pref.bits_65_128> 
,<lte_nb1_band_pref.bits_1_64> 
,<lte_nb1_band_pref.bits_65_128> 


Test command reports the supported range of values for 
parameters: 


<lte_m1_band_pref.bits_1_64>,<lte_m1_band_pref.bits_65_128> 


<lte_nb1_band_pref.bits_1_64>,<lte_nb1_band_pref.bits_65_128 


> 
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4,4, uBlox 
uBlox 


Band selection bitmask AT+UBANDMASK 


Write Command AT+UBANDMASK=<RAT>, 
<bitmask1>[,<bitmask2>] 


Read Command -> AT+UBANDMASK? 


Test Command -> AT+UBANDMASK=? 
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Response AT+UBANDMASK=0,2074 OK 


Parameter 


<RAT> Number Indicates the Radio Access Technology (RAT): « 0: 
LTE Cat M1 + 1: LTE Cat NB1 


<bitmask1> Number Indicated the bandmask for LTE bands 1 
through 64. Each bit enables/disables a band: + Bit 0: band 1 + Bit 
1: band 2 + Bit 2: band 3 + Bit 3: band 4 + .. + Bit 63: band 64 


<bitmask2> Number Indicated the bandmask for LTE bands 65 
through 128. Each bit enables/disables a band: « Bit 0: band 65 e 
Bit 1: band 66 + Bit 2: band 67 + Bit 3: band 68 + .. » Bit 63: band 128 


+UBANDMASK: <RAT>, <bitmask1>[,<bitmask2>][,<RAT>, 
<bitmask1>[,<bitmask2>]] OK 
Parameters See Write Command 


+UBANDMASK: (list of the supported <RAT>s),<bitmask1>, 
<bitmask2> OK Parameters See Write Command 


AT+QCGDEFCONT Set Default PSD Connection Settings 


Test Command AT+QCGDEFCONT=? 


Read Command AT+QCGDEFCONT? 


Write Command 
AT+QCGDEFCONT=<PDP_type=[,<A 
PN>[,<username=[,password]]] 


Max Response Time 
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Response 
+QCGDEFCONT: (list of supported <PDP_type>s) 
OK 


Response 

+QCGDEFCONT: <PDP_type>,<APN>,<username>,<pass 
word> 

OK 


Response 

OK 

If there is any error: 
ERROR 

or 

+CME ERROR: <err> 


300ms 
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Parameter 

AT+QCGDEFCONT Set Default PSD Connection Settings 
Test Command 

AT+QCGDEFCONT=? 

Response 

+QCGDEFCONT.: (list of supported <PDP_type>s) 
OK 


Read Command 
AT+QCGDEFCONT? 
Response 


CGDEFCONT: <PDP_type>,<APN>,<username>,<pass 
word> 


Write Command 

AT+OCGDEFCONT=<PDP_type>[,<A 

PN>[,<username>[ password]]] 

Response 

OK 

If there is any error: 

ERROR 

or 

+CME ERROR: <err> 

Maximum Response Time 300ms 

<PDP_type> String type. Specify the type of packet data 
protocol: 

"IP" Internet Protocol (IETF STD 5) 

"IPV6" Internet Protocol version 6 (IETF RFC 2460) 
"IPV4V6" Dual IP stack (see 3GPP TS 24.301) 

"Non-IP" Transfer of Non-IP data to external packet network 
(see 3GPP TS 24.301) 


AT*MCGDEFCONT Set Default PSD Connection Settings 


Test Command AT*MCGDEFC ONT=? 


Read Command 
AT*MCGDEFC 
ONT? 


Write Command 
AT*MCGDEFC 
ONT=<PDP_typ 
e>[,<APN>[,<use 
rname>[,<passw 
ord>]]] 
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Response 

*MCGDEFCONT: (list of supported <PDP_type>) 
OK 

Parameters 

See Write Command 


Response 

*MCGDEFCONT: <PDP_type>[,<APN>,<username>,<password>] 
OK 

Parameters 

See Write Command 


Response 

OK 

If error is related to wrong AT syntax: 
+CME ERROR: <err> 
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Parameter 

<PDP_type> (Packet Data Protocol type) a string parameter 
which specifies the type of packet data protocol : 

IP Internet Protocol (IETF STD 5) 

IPV6 Internet Protocol, version 6 (IETF RFC 2460) 

IPVAV6 Virtual <PDP_type) introduced to handle dual IP stack UE 
Capability (see 3GPP TS 24.301). 

Non-IP Transfer of Non-IP data to external packet data Network 
(see 3GPP TS 24.301). 


<APN> (Access Point Name) a string parameter that is a logical 


name 


that is used to select the GGSN or the external packet data 


network. If the 


value is null or omitted, then the subscription value will be 


requested. 


<username> String value. Username for the connection to the 


service 
provider. 


<password> String value. Password for the connection to the 


service 


provider AUTO_SAVE_REBOOT 


5. Other Commands and Information 


Check if the Device is attached to the 
mobile network or not. <state> values: 0: 


Detached from network 1: Attached to 
network 


Check if GPRS 
attached 


Check 
signal strength 


Get time/clock 


Enable automatic 
timezone update 


AT+CGATT? 


AT+CSQ 


AT+CCLK? 


AT+CTZU=1 


+CGATT: <state> > 
OK 


+CSQ: 
<signal_power>,<q 
ual> 

OK 


+CCLK: 
"YY /MM/DD,HH:MM 
:SS+ZZ" 

OK 


>OK 


5.1. Frequency Search and Roaming 


Request signal_power and qual. On many 
Chip Sets, qual will always be 99. The 
mapping between signal_power and RSSI 
dBm is -113 + (signal_power * 2). 

Example response: +CSQ: 25,99 

RSSI = (-113 + (25 * 2)) = -63 dBm 


Fetches the Device internal time/clock, 
which may be sync, to the loT network 
Time 


Enable automatic time zone update via 
NITZ (network identity and time zone) 


Ifa device is only to be used in Denmark, then we can limit the network search to band 20 
only. If the device roams, then we can advantageously limit it to frequency (s) known to be 
used in the country (s), but with a conditional statement that allows for searching on several 
bands if the device has not been able to connect for 24/36 hours. 
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It is recommended to limit NB-loT radio frequencies in the device to get the most optimal 


power consumption, without risking losing connection if a roaming provider changes 
frequency in the future. 


6. Troubleshooting 


6.1. Checklist 

- General description of the issue 

- Is the issue consistent and reproduceable, and if so, under which conditions? 

-  MSISDN, IMSI or ICCID of the SIM 

- Timestamp of the observation 

- Location of the observation 

- Radio Access Type used (2G, LTE, LTE-M, NB-loT) 

- Services used (Voice, SMS) 

- Which chipset is being used (HW & FW version) 

- Does the chipset/device observe the same behavior, when using the procedures described in 
this document? 


- Provide full AT command and response trace, including information on any pre-conditions. 


6.2. Contact 


Please contact Telenor at iot@telenor.dk with the information above, 
6.3. Advanced services 


For advanced troubleshooting or product verification cases, Telenor offers a dedicated Lab 
service. Please contact Telenor at iot@telenor.dk for information about available services. 
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